SQL Injection Vulnerability in Active Newsletter by Active Web Services
CVE-2007-1696

Currently unrated

Key Information:

Vendor

Active Web Softwares

Status
Active Newsletter
Vendor
CVE Published:
27 March 2007

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2007-1696?

An SQL injection vulnerability exists in ViewNewspapers.asp within Active Newsletter versions 4.3 and earlier. This flaw enables remote attackers to craft and execute arbitrary SQL commands via the NewsPaperID parameter, potentially compromising the underlying database and exposing sensitive information. Organizations using affected versions of Active Newsletter are urged to assess their systems and implement necessary security measures.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2007-1696 - Proof of Concept

References

http://www.vupen.com/english/advisories/2007/1098
vdb-entryx_refsource_VUPEN
https://exchange.xforce.ibmcloud.com/vulnerabilities/33197
vdb-entryx_refsource_XF
http://secunia.com/advisories/24640
third-party-advisoryx_refsource_SECUNIA

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.